build(deps): update npm to v11 - autoclosed

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
npm (source)	9.9.4 → 11.18.0

---

Release Notes

npm/cli (npm)

v11.18.0

Compare Source

v11.17.0

Compare Source

Features

• ae8ac4e #​9534 add min-release-age-exclude config (@​JamieMagee, @​caseyjhol)
• 8ff3e48 #​9483 allowScripts tooling and inBundle hardening (#​9483) (@​github-actions[bot], @​JamieMagee)

Bug Fixes

• 847cdf8 #​9541 match dotted and versioned args in approve-scripts/deny-scripts (@​owlstronaut)
• d99f7cb #​9535 emit valid JSON from approve-scripts/deny-scripts --json (@​owlstronaut)
• 351a309 #​9499 pass script-shell to publish lifecycle hooks (#​9499) (@​github-actions[bot])
• 4fa81df #​9497 recognize allowScripts for local link targets (#​9497) (@​github-actions[bot], @​cyphercodes, @​cyphercodes)
• 95cf2e9 #​9489 validate registry path for allow-remote tarballs (@​Abhinav-143x)
• 9dd219b #​9462 respect allowScripts policy in prune, dedupe, uninstall, audit, and link (#​9462) (@​github-actions[bot], @​JamieMagee)
• cd8d18a #​9482 list pending scripts in approve-scripts when ignore-scripts is set (#​9482) (@​github-actions[bot], @​JamieMagee)
• c14e87c #​9481 suggest --allow-scripts for global installs in unreviewed-scripts warnings (#​9481) (@​github-actions[bot], @​JamieMagee)
• 7ade52e #​9465 invalid issue template YAML indentation (#​9465) (@​github-actions[bot], @​fallintoplace)
• c069622 #​9464 show full parent command path in subcommand usage errors (#​9464) (@​owlstronaut)
• 1bb62bb #​9454 config: clarify --all help so it's accurate for approve-scripts and deny-scripts (@​JamieMagee)
• 84eeb5f #​9431 audit: don't apply min-release-age before filter when verifying installed signatures (@​JamieMagee)
• 3bd3377 #​9426 block forbidden keys in Queryable setter to prevent prototype pollution (@​12122J, @​claude)

Documentation

• a86a7a9 #​9522 approve-scripts only throws EGLOBAL when run with -g (@​JamieMagee)
• 693bb3d #​9508 clarify package.json override value specs (#​9508) (@​github-actions[bot], @​ded-furby)
• ccffe4a #​9501 use the latest version for global update and outdated's wanted (#​9501) (@​github-actions[bot], @​liangmiQwQ)
• 66e97c2 #​9478 update minimum npm required for npm trust (@​meeech)

Dependencies

• bd09b87 #​9542 postcss-selector-parser@7.1.4
• 95bfc4c #​9542 tinyglobby@0.2.17
• 8c0d5fd #​9542 tar@7.5.16
• 967d377 #​9542 semver@7.8.4
• cdaac1b #​9542 pacote@21.5.1
• 25c8a9e #​9542 node-gyp@12.4.0

Chores

• 2922fa4 #​9542 dev dependency updates (@​owlstronaut)
• workspace: @npmcli/arborist@9.8.0
• workspace: @npmcli/config@10.11.0
• workspace: libnpmdiff@8.1.10
• workspace: libnpmexec@10.3.0
• workspace: libnpmfund@7.0.24
• workspace: libnpmpack@9.1.10

v11.16.0

Compare Source

Features

• 4b67f6e #​9416 publish --access=private alias for restricted (#​9416) (@​github-actions[bot], @​reggi, @​Copilot)
• a10c7ca #​9415 Phase 1 of allowScripts opt-in install-script policy (#​9360) (#​9415) (@​owlstronaut, @​JamieMagee)

Bug Fixes

• 1f7869b #​9411 fix typo of fullMetadata (@​owlstronaut)
• cde03ba #​9390 config: pause progress spinner during interactive editor spawn (#​9388) (@​github-actions[bot], @​Zelys-DFKH, @​claude)

Documentation

• c5e9d73 #​9390 Document npm_old_version and npm_new_version environment variables (#​9389) (@​github-actions[bot], @​36degrees)

Dependencies

• cdd7bbc #​9421 undici@6.26.0
• fde87c9 #​9421 sigstore@4.1.1
• 2779793 #​9421 lru-cache@11.5.1
• dea702d #​9421 @sigstore/verify@3.1.1
• 4eab03f #​9421 @sigstore/core@3.2.1
• 74c7323 #​9421 @npmcli/agent@4.0.2
• edc4ab3 #​9421 semver@7.8.1
• 5f6ce33 #​9421 make-fetch-happen@15.0.6

Chores

• bd04976 #​9421 dev dependency updates (@​owlstronaut)
• aeceb23 #​9407 sanitize newlines in flags table default and type values (#​9407) (@​reggi, @​Copilot)
• workspace: @npmcli/arborist@9.7.0
• workspace: @npmcli/config@10.10.0
• workspace: libnpmdiff@8.1.9
• workspace: libnpmexec@10.2.9
• workspace: libnpmfund@7.0.23
• workspace: libnpmpack@9.1.9
• workspace: libnpmversion@8.0.4

v11.15.0

Compare Source

Features

• 0d5d899 #​9379 npm stage (@​reggi, @​Copilot)
• 1433740 #​9376 add permissions support to trust commands (#​9376) (@​github-actions[bot], @​reggi, @​Copilot)
• 8df10f5 #​9339 add allow-git/allow-file/allow-directory/allow-remote configs (@​owlstronaut)

Bug Fixes

• 39b625e #​9381 key stage download --json output by package name (#​9381) (@​reggi, @​Copilot)
• 6aa332d #​9339 allow min-release-age in npmrc to coexist with --before (@​raazkhnl)
• 468550f #​9339 refactor #failureNode, adjust tests and safety (@​owlstronaut)
• cabe249 #​9339 allow-remote=none does not block registry tarballs (@​owlstronaut)

Dependencies

• 8416a60 #​9383 socks@2.8.9
• 5e5a25b #​9383 lru-cache@11.5.0
• a6f9ad2 #​9383 ip-address@10.2.0
• 63f8114 #​9383 brace-expansion@5.0.6
• 6918b4c #​9383 bin-links@6.0.2
• bf84079 #​9383 tar@7.5.15
• bdef82c #​9383 semver@7.8.0
• 3f38a67 #​9383 hosted-git-info@9.0.3

Chores

• 816f3bf #​9383 dev dependency updates (@​owlstronaut)
• workspace: @npmcli/arborist@9.6.0
• workspace: @npmcli/config@10.9.1
• workspace: libnpmdiff@8.1.8
• workspace: libnpmexec@10.2.8
• workspace: libnpmfund@7.0.22
• workspace: libnpmpack@9.1.8
• workspace: libnpmpublish@11.2.0

v11.14.1

Compare Source

Bug Fixes

• dca12cb #​9328 remove settings (#​9328) (@​github-actions[bot], @​owlstronaut)

v11.14.0

Compare Source

Features

• 45fc5e0 #​9288 add allow-directory, allow-file, and allow-remote (#​9288) (@​github-actions[bot], @​wraithgar)

Bug Fixes

• 6c17544 #​9318 sbom: dedupe per-node dependsOn / relationships (#​9318) (@​github-actions[bot], @​mikaelkristiansson)

Dependencies

• 840fe18 #​9322 socks@10.1.1
• b771289 #​9322 ip-address@10.1.1
• addffcb #​9322 cidr-regex@5.0.5

Chores

• 041fd58 #​9322 dev dependency updates (@​owlstronaut)
• 89c505a #​9320 add cli-triage team as codeowner (#​9320) (@​github-actions[bot], @​owlstronaut)
• workspace: @npmcli/arborist@9.5.0
• workspace: @npmcli/config@10.9.0
• workspace: libnpmdiff@8.1.7
• workspace: libnpmexec@10.2.7
• workspace: libnpmfund@7.0.21
• workspace: libnpmpack@9.1.7

v11.13.0

Compare Source

Features

• 8e8dadb #​9246 add u as alias for update command (#​9246) (@​github-actions[bot], @​Ausoj)

Bug Fixes

• ecd161b #​9258 ignore intended error code (@​owlstronaut)

Dependencies

• 8d2fdcd #​9272 lru-cache@11.3.5
• e603d36 #​9272 node-gyp@12.3.0
• d48b7da #​9272 is-cidr@6.0.4
• 032a5ca #​9240 @sigstore/protobuf-specs@0.5.1
• 33a81e7 #​9240 tinyglobby@0.2.16
• 68dc4a0 #​9240 picomatch@4.0.4
• 1bb6703 #​9240 lru-cache@11.3.3
• 37059e4 #​9240 diff@8.0.4
• fb450ab #​9240 minimatch@10.2.5
• 7c4bbbf #​9240 tar@7.5.13
• 703a3bc #​9240 minipass-flush@1.0.6

Chores

• e0724ac #​9272 dev dependency updates (@​owlstronaut)
• d249341 #​9230 don't run npm update in CI (@​owlstronaut)
• workspace: @npmcli/arborist@9.4.3
• workspace: libnpmdiff@8.1.6
• workspace: libnpmexec@10.2.6
• workspace: libnpmfund@7.0.20
• workspace: libnpmpack@9.1.6

v11.12.1

Compare Source

Bug Fixes

• 596706a #​9148 revert prefer-offline/prefer-online exclusivity (#​9129) (@​owlstronaut)

Documentation

• d1ee8a5 #​9140 Add note on relative path prefix for npm publish (#​9140) (@​pydsigner)

Dependencies

• workspace: @npmcli/config@10.8.1

v11.12.0

Compare Source

Features

• 8eff5fb #​9049 audit: add --include-attestations flag to output sigstore bundles (#​9049) (@​mitchdenny)

Bug Fixes

• 03af94d #​9123 skip synopsis code block when command has no usage (@​owlstronaut)
• 21ea382 #​9110 arborist: resolve sibling override sets via common ancestor (#​9110) (@​manzoorwanijk)

Dependencies

• 03f4c3a #​9131 @sigstore/tuf@4.0.2
• 4d5f7d9 #​9131 @gar/promise-retry@1.0.3
• 8dcfe69 #​9131 @sigstore/sign@4.1.1
• e5a7e22 #​9127 lru-cache@11.2.7
• 82deab6 #​9127 make-fetch-happen@15.0.5
• ce195dc #​9127 cacache@20.0.4

Chores

• 95fa7f4 #​9132 fix docs test snapshot (#​9132) (@​wraithgar)
• 7e9d538 #​9127 dev dependency updates (@​wraithgar)
• 920e5ed #​9127 test snapshots (@​wraithgar)
• 98ccf92 #​9125 fix snap tests (@​owlstronaut)
• workspace: @npmcli/arborist@9.4.2
• workspace: @npmcli/config@10.8.0
• workspace: libnpmdiff@8.1.5
• workspace: libnpmexec@10.2.5
• workspace: libnpmfund@7.0.19
• workspace: libnpmpack@9.1.5

v11.11.1

Compare Source

Bug Fixes

• a9d242b #​9099 include all subcommands on main command help (#​9099) (@​wraithgar)
• 29b8407 #​9087 unwrap comments and lines meant for output (#​9087) (@​wraithgar)
• b56986a #​9095 ls: suppress false UNMET DEPENDENCYs in linked strategy (#​9095) (@​manzoorwanijk)
• 76c76e5 #​9083 ci: don't error on optional deps in the lockfile (#​9083) (@​wraithgar)
• a29aeee #​9028 arborist: retry bin-links on Windows EPERM (#​9028) (@​manzoorwanijk)
• 6565eeb #​9045 bypass packument cache to prevent ETARGET errors after publish (#​9045) (@​Jadu07)

Documentation

• 3b96929 #​9074 scripts: remove mention of obsolete root user behavior (#​9074) (@​mohd-akram)
• 16ac4e0 #​9054 fix workspace cross-dependency documentation (@​owlstronaut)

Dependencies

• 075ae23 #​9086 tar@7.5.11
• 13fa40d #​9086 pacote@21.5.0
• bf7ea2b #​9060 brace-expansion@5.0.4
• 2000d2c #​9060 minimatch@10.2.4
• d86b260 #​9060 tar@7.5.10
• dff1853 #​9060 @npmcli/run-script@10.0.4
• 93c3365 #​9060 write-file-atomic@7.0.1

Chores

• d1996a7 #​9060 dev dependency updates (@​wraithgar)
• workspace: @npmcli/arborist@9.4.1
• workspace: libnpmdiff@8.1.4
• workspace: libnpmexec@10.2.4
• workspace: libnpmfund@7.0.18
• workspace: libnpmpack@9.1.4

v11.11.0

Compare Source

Features

• 4fcd352 #​9017 add :type(registry) to query selector syntax (#​9017) (@​wraithgar)
• e1b21f0 #​8909 adds circleci to trust command (#​8909) (@​owlstronaut)
• 9a33ad0 #​8925 adds circleci to oidc (#​8925) (@​owlstronaut)

Bug Fixes

• 4426411 #​9026 npm audit signatures for keyless attestation registries (#​9026) (@​ajayk)
• 658b323 #​9010 handle legacy licenses array in sbom output (#​9010) (@​JNC4)

Documentation

• 143f8cd #​9007 docs shouldn't wrap yaml description (#​9007) (@​owlstronaut)

Dependencies

• 7798b6e #​9027 @gar/promise-retry@1.0.2
• 4838864 #​9027 balanced-match@4.0.4
• 0c200dd #​9027 brace-expansion@5.0.3
• f0606bb #​9027 spdx-license-ids@3.0.23
• d43f350 #​9027 make-fetch-happen@15.0.4
• 4d0918a #​9027 @npmcli/git@7.0.2
• 8912ca7 #​9027 minipass-fetch@5.0.2
• 450ff35 #​9027 npm-packlist@10.0.4
• 20ef5a5 #​9027 pacote@21.4.0
• 60f332c #​9008 remove promise-retry
• cb8b9c7 #​9008 add @gar/promise-retry@1.0.0
• workspace: @npmcli/arborist@9.4.0
• workspace: libnpmdiff@8.1.3
• workspace: libnpmexec@10.2.3
• workspace: libnpmfund@7.0.17
• workspace: libnpmpack@9.1.3

v11.10.1

Compare Source

Bug Fixes

• 9fac412 #​8995 improve unknown config warning with .npmrc section hint (#​8995) (@​umeshmore45)
• bb135cc #​8981 arborist: fix peerOptional dependency resolution in buildIdealTree (#​8981) (@​Saibamen, @​cursoragent)
• 5c03826 #​8993 remove tabular output from "npm view" (@​wraithgar)
• 4648f26 #​8993 remove tabular output from "npm team" (@​wraithgar)

Documentation

• 0a5756d #​8998 clarify unsupported custom .npmrc keys and recommend alternatives (#​8998) (@​maitrawebtech)
• 22c9153 #​8985 fix typo and grammar in README (#​8985) (@​csmit195, Chris)

Dependencies

• aa8ffbf #​9002 init-package-json@8.2.5 (#​9002)
• 67a0f09 #​9001 glob@13.0.6
• 56b8fd4 #​9001 minimatch@10.2.2
• aa7fef5 #​9001 minipass@7.1.3
• d3a4161 #​9000 @npmcli/package-json@7.0.5 (#​9000)
• 7aa9338 #​8993 remove cli-columns
• f7f7c53 #​8991 hoist balanced-match
• 10cb575 #​8991 hoist latest yallist
• 1b3dc9a #​8991 cidr-regex@5.0.3
• 4307af6 #​8991 glob@13.0.5
• 13b4d6a #​8991 minimatch@10.2.1
• 45d4000 #​8991 tar@7.5.9

Chores

• 40fcab4 #​8991 @npmcli/template-oss@4.29.0 (@​wraithgar)
• 1598adb #​8991 dev dependency updates (@​wraithgar)
• workspace: @npmcli/arborist@9.3.1
• workspace: @npmcli/config@10.7.1
• workspace: libnpmdiff@8.1.2
• workspace: libnpmexec@10.2.2
• workspace: libnpmfund@7.0.16
• workspace: libnpmpack@9.1.2

v11.10.0

Compare Source

Features

• cf56a1e #​8899 npm trust, per-command config (@​reggi)
• cf56a1e #​8899 npm trust (@​reggi)
• 66d6e11 #​8965 add min-release-age (#​8965) (@​wraithgar)

Dependencies

• aae84bf #​8973 pacote@21.3.1
• 8bcb675 #​8973 cidr-regex@5.0.2
• f87aaab #​8973 lru-cache@11.2.6
• acec871 #​8973 ssri@13.0.1
• 1e42a86 #​8973 glob@13.0.2
• e1c08a4 #​8973 is-cidr@6.0.3
• dfb0e34 #​8973 semver@7.7.4
• 0ee7776 #​8973 which@6.0.1

Chores

• eb81df8 #​8973 dev dependency updates (@​wraithgar)
• 995e757 #​8966 Clean up some todos, add tests for previously skipped blocks (@​owlstronaut)
• workspace: @npmcli/arborist@9.3.0
• workspace: @npmcli/config@10.7.0
• workspace: libnpmdiff@8.1.1
• workspace: libnpmexec@10.2.1
• workspace: libnpmfund@7.0.15
• workspace: libnpmpack@9.1.1

v11.9.0

Compare Source

Features

• f5f6cf7 #​8943 config: add --allow-git (@​wraithgar)

Bug Fixes

• 2242f25 #​8952 webauth: improve error messages around webauth in non-TTY (#​8952) (@​Andarist)

Dependencies

• 332c9f3 #​8960 glob@13.0.1
• eca02c7 #​8960 minimatch@10.1.2 @isaacs/brace-expansion@5.0.1
• b3f8475 #​8951 minipass-fetch@5.0.1
• 924171b #​8951 is-cidr@6.0.2
• 4404002 #​8951 ci-info@4.4.0
• b65af73 #​8951 lru-cache@11.2.5
• 164c355 #​8951 tar@7.5.7
• a74a19c #​8951 node-gyp@12.2.0
• e0bc212 #​8943 pacote@21.1.0

Chores

• 4a82a8f #​8951 dev dependency updates (@​wraithgar)
• workspace: @npmcli/arborist@9.2.0
• workspace: @npmcli/config@10.6.0
• workspace: libnpmdiff@8.1.0
• workspace: libnpmexec@10.2.0
• workspace: libnpmfund@7.0.14
• workspace: libnpmpack@9.1.0

v11.8.0

Compare Source

Features

• 545e861 #​8828 show proxy environment variables in npm config list (Max Black)

Bug Fixes

• c2f784d #​8859 preserve serialNumber UUID in CycloneDX SBOM output #​8837 (#​8859) (@​saksham-malhotra-27)
• f2c3af7 #​8840 more intuitive byte formatting boundaries for rounding (#​8840) (@​watilde)

Documentation

• 3474ec3 #​8866 fix typo/logic error in npm-dedupe docs (#​8866) (@​Schweinepriester)
• 5552e46 #​8797 npm-install: explain package-lock.json behavior (#​8797) (@​MaxBlack-dev, Max Black)

Dependencies

• f478ca0 #​8919 postcss-selector-parser@7.1.1
• 2b6a71f #​8919 path-scurry@2.0.1
• 19096f2 #​8919 sigstore@4.1.0
• [e7f5d1e](https://redirect.github.com/npm/cli/commit

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.